Cross-chain bridge protocol Allbridge suspended its operations after an attacker drained roughly $1.65 million through a flash loan exploit that manipulated the platform's liquidity pools.
How the Attack Unfolded
The exploit began with the attacker borrowing about $1.12 million via a flash loan from lending platform Kamino. Using those borrowed funds, the attacker manipulated the ratios within Allbridge's liquidity pools, distorting the pricing mechanism the protocol relies on to process cross-chain transfers.
With the pool ratios skewed in their favor, the attacker was able to withdraw assets at rates far more advantageous than they should have received under normal market conditions. The stolen funds were then bridged out, complicating recovery efforts and obscuring the trail.
A single flash loan turned a routine liquidity pool into a $1.65 million payday for the attacker.
Flash loans, which allow users to borrow large sums without collateral so long as the loan is repaid within a single transaction, have become a favored tool for exploiters targeting decentralized finance protocols. They enable attackers to amass enough capital to move markets and pools instantly, then repay the loan once the manipulation has paid off.
Protocol Response and Broader Implications
In the wake of the incident, Allbridge moved to halt its operations to prevent further losses and assess the damage. Suspending activity is a common defensive step for protocols under attack, buying time to investigate vulnerabilities and coordinate any potential response.
The breach adds to a long list of security failures involving cross-chain bridges, which remain among the most frequently targeted components of the crypto ecosystem. Their role in holding and transferring large volumes of assets across networks makes them especially attractive to attackers.
- The attacker borrowed roughly $1.12 million from Kamino via a flash loan
- Manipulated pool ratios allowed withdrawals at favorable rates
- Total losses reached approximately $1.65 million
- Allbridge paused operations following the exploit
The episode underscores ongoing concerns about the resilience of DeFi infrastructure, where pricing mechanisms tied to liquidity pools can be exploited when safeguards fail to account for rapid, large-scale capital movements.